Joemt
asked on
SBS2011 Shut down unexpectedly - Error log: Source User32, event ID 1074 "No Title for this reason can be found"
SBS2011 initiated a shutdown unexpectedly. I trying to identify why the server suddenly shutdown.
Found in Event Log:
Log Name: System - Source = USER32, Event ID = 1074
The process c:\windows\system32\winlog in.exe (SBSERVER) has initiated the power off of computer SBSERVer on behalf of user NT AUTHORITY\SYSTEM for the following reason" No title for this reason could be found
Reason code 0x500ff
Shutdown Type: power off
Prior to this I found an event log for:
System /source = WAS/Event Id= 5117
A worker process with a process id of "21708" serving application pool "WsusPool" has requested a recycle because it has reached it's private memory limit
Could the WAS issue caused the shutdown?
Found in Event Log:
Log Name: System - Source = USER32, Event ID = 1074
The process c:\windows\system32\winlog
Reason code 0x500ff
Shutdown Type: power off
Prior to this I found an event log for:
System /source = WAS/Event Id= 5117
A worker process with a process id of "21708" serving application pool "WsusPool" has requested a recycle because it has reached it's private memory limit
Could the WAS issue caused the shutdown?
ASKER
The Server again went down...I found this in the system log. Any ideas?
Log Name: System
Source: Microsoft-Windows-GroupPol icy
Date: 6/3/2014 5:05:28 PM
Event ID: 1058
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: SBSERVER.****.local
Description:
The processing of Group Policy failed. Windows attempted to read the file \\****.local\SysVol\****.l ocal\Polic ies\{65AD7 12B-7661-4 EC7-B609-8 C3AC7770B7 C}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Gr oupPolicy" Guid="{AEA1B4FA-97D1-45F2- A64C-4D69F FFD92C9}" />
<EventID>1058</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>1</Opcode>
<Keywords>0x80000000000000 00</Keywor ds>
<TimeCreated SystemTime="2014-06-03T23: 05:28.6065 06600Z" />
<EventRecordID>1436497</Ev entRecordI D>
<Correlation ActivityID="{9B6FA122-6787 -4F81-AD46 -D434970D2 507}" />
<Execution ProcessID="1004" ThreadID="7900" />
<Channel>System</Channel>
<Computer>SBSERVER.******. local</Com puter>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="SupportInfo1">4</Dat a>
<Data Name="SupportInfo2">816</D ata>
<Data Name="ProcessingMode">0</D ata>
<Data Name="ProcessingTimeInMill iseconds"> 17534</Dat a>
<Data Name="ErrorCode">64</Data>
<Data Name="ErrorDescription">Th e specified network name is no longer available. </Data>
<Data Name="DCName">SBSERVER.*** **.local</ Data>
<Data Name="GPOCNName">cn={65AD7 12B-7661-4 EC7-B609-8 C3AC7770B7 C},cn=poli cies,cn=sy stem,DC=** ***,DC=loc al</Data>
<Data Name="FilePath">\\*****.lo cal\SysVol \beallaw.l ocal\Polic ies\{65AD7 12B-7661-4 EC7-B609-8 C3AC7770B7 C}\gpt.ini </Data>
</EventData>
</Event>
Log Name: System
Source: Microsoft-Windows-GroupPol
Date: 6/3/2014 5:05:28 PM
Event ID: 1058
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: SBSERVER.****.local
Description:
The processing of Group Policy failed. Windows attempted to read the file \\****.local\SysVol\****.l
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Gr
<EventID>1058</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>1</Opcode>
<Keywords>0x80000000000000
<TimeCreated SystemTime="2014-06-03T23:
<EventRecordID>1436497</Ev
<Correlation ActivityID="{9B6FA122-6787
<Execution ProcessID="1004" ThreadID="7900" />
<Channel>System</Channel>
<Computer>SBSERVER.******.
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="SupportInfo1">4</Dat
<Data Name="SupportInfo2">816</D
<Data Name="ProcessingMode">0</D
<Data Name="ProcessingTimeInMill
<Data Name="ErrorCode">64</Data>
<Data Name="ErrorDescription">Th
<Data Name="DCName">SBSERVER.***
<Data Name="GPOCNName">cn={65AD7
<Data Name="FilePath">\\*****.lo
</EventData>
</Event>
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
finally ended up with a error indicator on the server it self - corrected with new powers upply
what is the answer
Check the hardware logs to see why the shutdown wasn't graceful - I have had this issue before on a SBS - turns out, the hardware wasn't allowing graceful shutdown.